{"id":42943,"date":"2020-02-17T14:41:56","date_gmt":"2020-02-17T11:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/iz-chrome-web-store-udaleno-bolee-500-vredonosnyh-dopolnenij"},"modified":"2020-02-17T14:41:56","modified_gmt":"2020-02-17T11:41:56","slug":"iz-chrome-web-store-udaleno-bolee-500-vredonosnyh-dopolnenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/iz-chrome-web-store-udaleno-bolee-500-vredonosnyh-dopolnenij","title":{"rendered":"More than 500 malicious extensions have been removed from the Chrome Web Store","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The results are in<\/a><\/noindex> of blocking a series of malicious browser extensions for Chrome that affected several million users. Initially, independent researcher Jamila Kaya (Jamila Kaya<\/a><\/noindex>) and Duo Security identified 71 malicious extensions in the Chrome Web Store. In total, these extensions had more than 1.7 million installations. After informing Google about the issue, over 430 similar extensions were discovered in the catalog, the number of installations for which has not been disclosed. <\/p>\n

Notably, despite the impressive number of installations, none of the problematic extensions have user reviews, raising questions about how these extensions were installed and how the malicious activity went unnoticed. Currently, all problematic extensions have been removed from the Chrome Web Store.
\nAccording to researchers, the malicious activity linked to the blocked extensions has been ongoing since January 2019, but certain domains used for malicious actions were registered back in 2017. <\/p>\n

The majority of malicious extensions were presented as tools for product promotion and participation in advertising services (users view ads and receive payments). The extensions employed a technique of redirecting to advertised websites when opening pages that were shown in sequence before displaying the requested site. <\/p>\n

All extensions used a similar technique to conceal malicious activity and bypass verification mechanisms in the Chrome Web Store. The code of all extensions was almost identical at the source code level, except for the function names, which were unique in each extension. The transmission of malicious logic was carried out from centralized control servers. Initially, the extension connected to a domain that had the same name as the extension (for example, Mapstrek.com), after which it redirected to one of the control servers that delivered the script for further actions.<\/p>\n

Among the actions performed through the extensions, there are mentions of uploading confidential user data to external servers, redirecting to malicious websites, and facilitating the installation of malware (for example, a message appears about a computer infection, and malicious software is offered under the guise of antivirus or browser updates). The domains to which redirection occurred include various phishing domains and sites exploiting outdated browsers with unpatched vulnerabilities (for instance, after exploitation, attempts were made to install malware that intercepts access keys and analyzes the transmission of confidential data via the clipboard).<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043e\u0434\u0432\u0435\u0434\u0435\u043d\u044b \u0438\u0442\u043e\u0433\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0440\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0443 Chrome, \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0442\u0430\u043b\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430 \u043f\u0435\u0440\u0432\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0414\u0436\u0430\u043c\u0438\u043b\u044f \u041a\u0430\u0439\u044f (Jamila Kaya) \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Duo Security \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Chrome Web Store 71 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 1.7 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Google \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435, \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-42943","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47More than 500 malicious extensions removed from Chrome Web Store | ProHoster","description":"The results of blocking a series of malicious extensions for the Chrome browser have been summarized, which affected several victims.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/iz-chrome-web-store-udaleno-bolee-500-vredonosnyh-dopolnenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 Chrome Web Store \u0443\u0434\u0430\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 500 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041f\u043e\u0434\u0432\u0435\u0434\u0435\u043d\u044b \u0438\u0442\u043e\u0433\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0440\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0443 Chrome, \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0442\u0430\u043b\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e.","og:url":"https:\/\/prohoster.info\/en\/blog\/iz-chrome-web-store-udaleno-bolee-500-vredonosnyh-dopolnenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-17T11:41:56+00:00","article:modified_time":"2020-02-17T11:41:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"42943","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:51:33","updated":"2022-09-28 18:42:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/42943","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=42943"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/42943\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=42943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=42943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=42943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}